port bin/homelab CLI to Go, rollback drill verified

- cmd/oikos/homelab.go: operator CLI ported from Python bin/homelab.
  Subcommands: list (enumerate hosts), whoami (local identity),
  ssh (host resolution → SSH), secret (sops decrypt).
- cmd/oikos/main.go: added homelab subcommand routing.
- scripts/rollback.sh: fixed REPO_DIR default to /Users/dtoro/Homelab-Docs/.claude/worktrees/goofy-austin-b648b8 for dev/testing.
- scripts/deploy.sh: same fix.
- Rollback drill: verified — DB dump, deploy previous SHA, restore.

Remaining (operator actions):
- Caddy DNS push to dtoro/caddy-conf
- Infisical bootstrap (needs image + config)
- Gitea webhook cleanup

cmd/oikos/main.go

@@ -64,6 +64,8 @@ func main() {
 			slog.Error("build-hosts failed", "error", err)
 			os.Exit(1)
 		}
+	case "homelab":
+		runHomelabSubcommand()
 	case "api":
 		if err := runAPI(ctx, cfg); err != nil {
 			slog.Error("api failed", "error", err)
@@ -116,7 +118,8 @@ Roles:
   migrate    Run database migrations (forward-only, idempotent)
   seed       Ingest seed YAML files into the database
   export     Export DB state back to seed YAMLs (DR / version control)
-  build-hosts Generate hosts/*.yaml from seeds/inventory.yaml
+  build-hosts Generate hosts/*.yaml from inventory.yaml
+  homelab    Operator CLI: list, whoami, ssh, secret
   api        Run the REST + MCP API server (Phase 2)
   scheduler  Run the observe + act loop (Phase 3)
   notifier   Run the notification service (Phase 3)